docker-compose.yml

services:
  opencode2api:
    build:
      context: .
      dockerfile: Dockerfile
    image: ghcr.io/samson910022/opencode2api:latest
    container_name: opencode2api
    ports:
      - "${OPENCODE_PROXY_PORT:-${PORT:-10000}}:${OPENCODE_PROXY_PORT:-${PORT:-10000}}"
    # Every config entry defaults to empty on purpose: a non-empty compose
    # default would win over a mounted config.json (or a legacy alias) because
    # the merge order is env canonical > env legacy alias > file > hardcoded
    # default. Code owns the documented defaults, so empty env + no file
    # behaves exactly like the old non-empty env.
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - OPENCODE_SERVER_PASSWORD=${OPENCODE_SERVER_PASSWORD:-}
      - OPENCODE_ZEN_API_KEY=${OPENCODE_ZEN_API_KEY:-}
      - API_KEY=${API_KEY:-}
      - API_KEYS=${API_KEYS:-}
      - OPENCODE_API_KEYS=${OPENCODE_API_KEYS:-}
      - BIND_HOST=${BIND_HOST:-}
      - OPENCODE_PROXY_BIND_HOST=${OPENCODE_PROXY_BIND_HOST:-}
      - DISABLE_TOOLS=${DISABLE_TOOLS:-}
      - OPENCODE_DISABLE_TOOLS=${OPENCODE_DISABLE_TOOLS:-}
      - OPENCODE_USE_ISOLATED_HOME=${OPENCODE_USE_ISOLATED_HOME:-}
      - OPENCODE_PROXY_DEBUG=${OPENCODE_PROXY_DEBUG:-}
      - OPENCODE_PROXY_PROMPT_MODE=${OPENCODE_PROXY_PROMPT_MODE:-}
      - OPENCODE_PROXY_OMIT_SYSTEM_PROMPT=${OPENCODE_PROXY_OMIT_SYSTEM_PROMPT:-}
      - OPENCODE_PROXY_AUTO_CLEANUP_CONVERSATIONS=${OPENCODE_PROXY_AUTO_CLEANUP_CONVERSATIONS:-}
      - OPENCODE_PROXY_CLEANUP_INTERVAL_MS=${OPENCODE_PROXY_CLEANUP_INTERVAL_MS:-}
      - OPENCODE_PROXY_CLEANUP_MAX_AGE_MS=${OPENCODE_PROXY_CLEANUP_MAX_AGE_MS:-}
      - OPENCODE_PROXY_REQUEST_TIMEOUT_MS=${OPENCODE_PROXY_REQUEST_TIMEOUT_MS:-}
      - OPENCODE_PROXY_RETRY_MAX_RETRIES=${OPENCODE_PROXY_RETRY_MAX_RETRIES:-}
      - RETRY_MAX_RETRIES=${RETRY_MAX_RETRIES:-}
      - OPENCODE_UPSTREAM_PROXIES=${OPENCODE_UPSTREAM_PROXIES:-}
      - UPSTREAM_PROXIES=${UPSTREAM_PROXIES:-}
      - OPENCODE_UPSTREAM_PROXY_STRATEGY=${OPENCODE_UPSTREAM_PROXY_STRATEGY:-}
      - UPSTREAM_PROXY_STRATEGY=${UPSTREAM_PROXY_STRATEGY:-}
      - OPENCODE_UPSTREAM_PROXY_COOLDOWN_MS=${OPENCODE_UPSTREAM_PROXY_COOLDOWN_MS:-}
      - UPSTREAM_PROXY_COOLDOWN_MS=${UPSTREAM_PROXY_COOLDOWN_MS:-}
      - OPENCODE_UPSTREAM_PROXY_NO_PROXY=${OPENCODE_UPSTREAM_PROXY_NO_PROXY:-}
      - UPSTREAM_PROXY_NO_PROXY=${UPSTREAM_PROXY_NO_PROXY:-}
      - PORT=${PORT:-}
      - OPENCODE_PROXY_PORT=${OPENCODE_PROXY_PORT:-}
      - OPENCODE_SERVER_PORT=${OPENCODE_SERVER_PORT:-}
      - OPENCODE_SERVER_URL=${OPENCODE_SERVER_URL:-}
      - OPENCODE_PATH=${OPENCODE_PATH:-}
      - OPENCODE_PROXY_MANAGE_BACKEND=${OPENCODE_PROXY_MANAGE_BACKEND:-}
      - OPENCODE_EXTERNAL_TOOLS_MODE=${OPENCODE_EXTERNAL_TOOLS_MODE:-}
      - OPENCODE_EXTERNAL_TOOLS_CONFLICT_POLICY=${OPENCODE_EXTERNAL_TOOLS_CONFLICT_POLICY:-}
      - OPENCODE_EXTERNAL_TOOL_POLICY_MODE=${OPENCODE_EXTERNAL_TOOL_POLICY_MODE:-}
      - EXTERNAL_TOOL_POLICY_MODE=${EXTERNAL_TOOL_POLICY_MODE:-}
      - OPENCODE_EXTERNAL_TOOL_DEFAULT_RISK_LEVEL=${OPENCODE_EXTERNAL_TOOL_DEFAULT_RISK_LEVEL:-}
      - EXTERNAL_TOOL_DEFAULT_RISK_LEVEL=${EXTERNAL_TOOL_DEFAULT_RISK_LEVEL:-}
      - OPENCODE_EXTERNAL_TOOL_ALLOWLIST=${OPENCODE_EXTERNAL_TOOL_ALLOWLIST:-}
      - EXTERNAL_TOOL_ALLOWLIST=${EXTERNAL_TOOL_ALLOWLIST:-}
      - OPENCODE_EXTERNAL_TOOL_DENYLIST=${OPENCODE_EXTERNAL_TOOL_DENYLIST:-}
      - EXTERNAL_TOOL_DENYLIST=${EXTERNAL_TOOL_DENYLIST:-}
      - OPENCODE_EXTERNAL_TOOL_REQUIRE_CONFIRMATION_FOR=${OPENCODE_EXTERNAL_TOOL_REQUIRE_CONFIRMATION_FOR:-}
      - EXTERNAL_TOOL_REQUIRE_CONFIRMATION_FOR=${EXTERNAL_TOOL_REQUIRE_CONFIRMATION_FOR:-}
      - OPENCODE_INTERNAL_WEB_FETCH_ENABLED=${OPENCODE_INTERNAL_WEB_FETCH_ENABLED:-}
      - OPENCODE_INTERNAL_ALLOWED_TOOLS=${OPENCODE_INTERNAL_ALLOWED_TOOLS:-}
      - OPENCODE_INTERNAL_TOOL_METRICS_ENABLED=${OPENCODE_INTERNAL_TOOL_METRICS_ENABLED:-}
      - OPENCODE_TOOL_DISCOVERY_FIXTURE=${OPENCODE_TOOL_DISCOVERY_FIXTURE:-}
      - OPENCODE_HEALTH_DETAILS_ENABLED=${OPENCODE_HEALTH_DETAILS_ENABLED:-}
      - OPENCODE_HEALTH_DETAILS_REQUIRE_AUTH=${OPENCODE_HEALTH_DETAILS_REQUIRE_AUTH:-}
      - OPENCODE_METRICS_ENABLED=${OPENCODE_METRICS_ENABLED:-}
      - OPENCODE_METRICS_REQUIRE_AUTH=${OPENCODE_METRICS_REQUIRE_AUTH:-}
    volumes:
      - opencode-data:/home/node/.local/share/opencode
      - opencode-config:/home/node/.config/opencode
    restart: unless-stopped
    # Guard small (1GB) hosts: cap memory/CPU so one slow request cannot wedge
    # the whole machine (see `docs/host-deployments.md` §9). Raw `docker run`
    # hosts should pass the equivalents: --memory=768m --memory-reservation=256m
    # --cpus=1.5 --pids-limit=256.
    mem_limit: 768m
    mem_reservation: 256m
    cpus: 1.5
    pids_limit: 256
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      # Shallow on purpose: /health needs no auth; /health/details would 401
      # when HEALTH_DETAILS_REQUIRE_AUTH=true and has no credentials here.
      test: ["CMD", "curl", "-f", "http://localhost:${OPENCODE_PROXY_PORT:-${PORT:-10000}}/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      # Must cover entrypoint backend wait (~180s on cold small hosts) plus
      # probe intervals; 120s flapped unhealthy during normal warmup.
      start_period: 200s

volumes:
  opencode-data:
  opencode-config: